A hospital must send all guest VPN traffic through a centralized firewall service before Internet exit, needs automatic route advertisement for the service location, and wants to avoid per-branch static routes. Which service-chaining design via control policy correctly steers to the firewall TLOC?
Select an answer to reveal the explanation.
Short Explanation
Patient networks demand clean inspection paths, and you're on it. A service TLOC flags the firewall like a security checkpoint everyone must pass. Control policy then reroutes guest prefixes that way.
Full Explanation
The correct design works because advertising the firewall as a service TLOC injects its location into OMP for automatic network-wide discovery and the control policy modifies route advertisement so guest VPN prefixes resolve via that service next hop, which centralizes inspection before Internet exit while eliminating per-branch static configuration. The data-policy variant fails by plane because data policy influences forwarding behavior after routing decisions and does not advertise service location through OMP, so although it is commonly used for application-aware steering toward a firewall it cannot satisfy the explicit via control policy with automatic advertisement requirement. The all-VPN redirect variant fails by scope because extending the same service TLOC control policy beyond the guest VPN breaks segmentation and forces trusted clinical and corporate traffic through the guest inspection path, increasing load and violating the requirement to chain only guest traffic. The branch-static variant fails by operations because configuring individual static routes reintroduces manual sprawl, operational drift, and lack of dynamic failover, directly contradicting automatic advertisement and avoidance of static routes even though centralized inspection still occurs. Exam caveat: distinguish control policy that alters OMP reachability and TLOC resolution from data policy that alters forwarding actions, since stems mentioning advertise, redistribute, or service location point to control policy. Practical check: verify OMP database shows guest VPN routes with the firewall service TLOC next hop on spokes, confirm guest egress sessions appear in firewall logs, and audit branches for absence of residual static routes toward the service.